ImportantNEAR Intents Releases Security Incident Post-Mortem Report, All $3.8 Million in Funds Fully Recovered
NEAR Intents has published a post-mortem report on the October 1 security incident. A vulnerability related to interactions with third-party contracts existed in its smart contract. Exploiting the refund mechanism following failed calls, the attacker caused funds to be refunded while the corresponding deposit records remained intact, generating approximately $3.8 million in fictitious balances via 23 failed deposit transactions, before subsequently siphoning the funds through the Omni cross-chain infrastructure. This vulnerability resided in the NEAR Intents contract itself, and was not a flaw in the Omni infrastructure. All funds were fully recovered within 36 hours of the vulnerability being identified. The team has removed the associated deposit notification functionality, implemented abnormal balance monitoring and automatic suspension mechanisms, and paid a $300,000 bug bounty to the researcher who reported another critical vulnerability in the same functionality on October 7. The system has now resumed normal operations.
Source: PANewsRead original
- #Hack